Author:
Australia | Publication | October 2021
On 29 September 2021, the Parliamentary Joint Committee on Intelligence and Security (PJCIS) published its Advisory Report on the Security Legislation Amendment (Critical Infrastructure) Bill 2020 (Original Bill) and statutory review of the Security of Critical Infrastructure Act 2018 (SOCI Act).
In essence, the PJCIS recommended that the Original Bill be split into two separate bills with the stated purpose of expanding the critical infrastructure sectors covered by the SOCI Act, introducing mandatory reporting obligations and the key purpose of prioritising the Government Assistance Measures. These security upgrade measures are seen as the most urgent and should progress through Parliament ‘in the shortest time possible’.1
The PJCIS further recommended that the remainder of the Original Bill, which includes the risk management program and the enhanced cyber security obligations, targeted at attaining an overall security uplift across the critical infrastructure sectors, should be reconsidered and repackaged in consultation with industry before progressing further.2 Table 1 below outlines the PJCIS’ recommended approach.
In recommending to split the Original Bill, the PJCIS focused primarily on evidence of an increasing cyber-threat environment. The PJCIS cited the Department of Home Affairs Secretary Michael Pezzullo’s submission as informing the recommendation to carve out these Government Assistance powers into a separate bill:3
‘...it allows us to activate certain emergency procedures under the government assistance measures, and it is those measures that, frankly, I would prefer to have on the statute books tonight.’
In recommending the carve out approach, the PJCIS included the expanded definitions of Critical Infrastructure Assets and Critical Infrastructure Sectors, as well as the obligation on responsible entities to notify the Government of critical incidents.4 These amendments remain highly relevant to companies in the applicable sectors as the government’s assistance powers were concerning to many, both in regard to their reach and application. However, in prioritising the creation of the government’s intervention powers, the PJCIS was evidently convinced that the threat was real and present.
The PJCIS recommended that the remainder of the Original Bill be ‘revisited and reconsidered’ by the Department in a separate bill, known as “Bill Two”.5 This approach recognises the deep ‘reservation’ and concern from industry and other stakeholders about the wide-ranging scope and the ‘unknown or unquantifiable’ cost of compliance with the other elements of the Original Bill, including the risk management programs and declaration of systems of national security (and associated enhanced cyber security obligations). Indeed, the PJCIS noted that most, if not all, contributors to the review expressed reservations and concluded that, as currently formulated, the framework was not ready to be progressed at this time.6
In particular, the PJCIS cited several factors including:
By recommending the separation of the Original Bill, the PJCIS appears to acknowledge the threat environment and provides a pathway for the Government to obtain the emergency intervention powers it wanted without the more controversial elements that may have resulted in Parliamentary deadlock. Sacrificing the more compliance-focused elements of the SOCI reforms in the immediate future is an effective trade-off for the government, especially where alternative regulatory avenues may be available to drive cyber-security uplift.8
And while this may have removed potential compliance burdens on industry for the time-being, the potential for direct Government intervention in respect of critical infrastructure, and the over-arching risk of cyber-threat itself, remains.
Table 1: Recommended Split Response
| Status |
Proposed Amendments | |
|---|---|---|
| Bill One | To proceed urgently |
|
| Bill Two | To re-design in consultation with industry |
|
Source: Advisory Report
Please see our previous update which provides a broader overview of the SOCI reforms. We continue to monitor and publish further updates. If you have any queries in respect of how the proposed legislation may impact your operations, or how we may be able to assist with your engagement with any consultation processes, please get in touch.
Publication
On October 22, 2024, the Canada Industrial Relations Board (CIRB) published written reasons for a decision delivered verbally on August 24, 2024.
Publication
Following the commencement at 12:01 a.m. on Friday, November 15, of a national strike by the Canadian Union of Postal Workers, shutting down Canada Post’s operations across the country, the Canadian Securities Administrators (CSA) have published guidance recommending that all stakeholders required to deliver documents to securityholders contact their local securities regulator or visit their local regulator’s website for guidance.
Publication
The Canadian Intellectual Property Office (CIPO) is undergoing a modernization effort to provide a new online portal for patent services that serves as a centralized online platform for filing, tracking and managing patent files.
Subscribe and stay up to date with the latest legal news, information and events . . .
© Norton Rose Fulbright LLP 2023
